Integrate Purview with Cloud App Events

id: a1adce9c-5945-4a20-984e-d95b6071a791
name: Integrate Purview with Cloud App Events
description: |
  "This query searches for any files in Cloud App Events that have trigger a security alert."
severity: Medium
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - CloudAppEvents
  - connectorId: MicrosoftCloudAppSecurity
    dataTypes:
      - SecurityAlert
tactics:
  - Collection
relevantTechniques:
  - T1074
query: |
  SecurityAlert
    | where TimeGenerated >= ago(30d)
    | extend EntitiesDynamicArray = parse_json(Entities) 
    | mv-expand EntitiesDynamicArray
    | extend Entitytype = tostring(parse_json(EntitiesDynamicArray).Type), EntityName = tostring(parse_json(EntitiesDynamicArray).Name),
    EntityUPNSuffix = tostring(parse_json(EntitiesDynamicArray).UPNSuffix)
    | where Entitytype =~ "file" and EntityName != ""
    | join kind=inner(CloudAppEvents
    | extend ActivityObjectsDynamicArray = parse_json(ActivityObjects) 
    | mv-expand ActivityObjectsDynamicArray
    | extend Entitytype = tostring(parse_json(ActivityObjectsDynamicArray).Type), EntityName = tostring(RawEventData.SourceFileName),
    EntityUPNSuffix = tostring(parse_json(ActivityObjectsDynamicArray).UPNSuffix)
    | where Entitytype =~ "file") on $left.EntityName == $right.EntityName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: EntityName
      - identifier: UPNSuffix
        columnName: EntityUPNSuffix
      - identifier: FullName
        columnName: UserId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIP
version: 1.0.0
kind: Scheduled